MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 331e0545b911444c302b070c84493a6583f2f6c59a63a3b405ec725b3630a57c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments 1

SHA256 hash:	331e0545b911444c302b070c84493a6583f2f6c59a63a3b405ec725b3630a57c
SHA3-384 hash:	48d314e3235bf23b6f2c19b3a4b969b131cc5586d60ccd2663e026fb2c6c5bcd0327046cc0197fd62d4d1f59be907b20
SHA1 hash:	1aadce1aceb22a87cdc2d40afe2837112d874b14
MD5 hash:	16b07927ff4a1d071fc3b34abbd0adcc
humanhash:	sodium-mango-paris-carbon
File name:	16b07927ff4a1d071fc3b34abbd0adcc
Download:	download sample
Signature	Heodo Create hunting rule
File size:	626'688 bytes
First seen:	2022-03-10 12:18:05 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	53dedb5b7ba9393b690bb5ddcd3da470 (39 x Heodo)
ssdeep	12288:PeRO5DDUmhnspspsqi022/OBywMbiVifM3SD2tVQQIggVurxFbVCCKUggfArArA1:WRO5DDUmhnspspsqi022/OByw+iVifM4
Threatray	1'252 similar samples on MalwareBazaar
TLSH	T151D46B2271DE4073CC9A107C0811E59FD59EF978F627E84FA298AEAD2EE13C94534F09
Reporter	zbetcheckin
Tags:	32 dll Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

201

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/249135/

Detection(s):

SecuriteInfo.com.Trojan0058d9ee1.24773.20643.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

control.exe greyware keylogger packed shell32.dll

Link:

https://www.filescan.io/uploads/6229ec87b94fb38cb451c4b0/reports/8197fe1c-ee4b-4c61-ac2f-32da353b968e/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2fb7e74f-92d6-42bc-9f56-0a7586f69561

Result

Threat name:

Emotet

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/954177

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Sigma detected: Regsvr32 Command Line Without DLL

Sigma detected: Regsvr32 Network Activity

Sigma detected: Suspicious Call by Ordinal

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected Emotet

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/331e0545b911444c302b070c84493a6583f2f6c59a63a3b405ec725b3630a57c/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2022-03-10 12:18:20 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

23 of 27 (85.19%)

Threat level:

5/5

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch5 banker suricata trojan

Link:

https://tria.ge/reports/220310-pgntkshhaq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Emotet

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Malware Config

C2 Extraction:

51.75.33.122:443
186.250.48.5:80
168.119.39.118:443
207.148.81.119:8080
194.9.172.107:8080
139.196.72.155:8080
78.47.204.80:443
159.69.237.188:443
45.71.195.104:8080
54.37.106.167:8080
185.168.130.138:443
37.44.244.177:8080
185.184.25.78:8080
185.148.168.15:8080
128.199.192.135:8080
37.59.209.141:8080
103.41.204.169:8080
185.148.168.220:8080
103.42.58.120:7080
78.46.73.125:443
68.183.93.250:443
190.90.233.66:443
5.56.132.177:8080
62.171.178.147:8080
196.44.98.190:8080
168.197.250.14:80
66.42.57.149:443
59.148.253.194:443
104.131.62.48:8080
191.252.103.16:80
54.37.228.122:443
88.217.172.165:8080
195.77.239.39:8080
116.124.128.206:8080
93.104.209.107:8080
118.98.72.86:443
217.182.143.207:443
87.106.97.83:7080
210.57.209.142:8080
54.38.242.185:443
195.154.146.35:443
203.153.216.46:443
198.199.98.78:8080
85.214.67.203:8080

Unpacked files

SH256 hash:

331e0545b911444c302b070c84493a6583f2f6c59a63a3b405ec725b3630a57c

MD5 hash:

16b07927ff4a1d071fc3b34abbd0adcc

SHA1 hash:

1aadce1aceb22a87cdc2d40afe2837112d874b14

Link:

https://www.unpac.me/results/8828f173-fc1a-4da1-b540-70d55d19b0fc/

Malware family:

Emotet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/331e0545b911/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/331e0545b911444c302b070c84493a6583f2f6c59a63a3b405ec725b3630a57c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll 331e0545b911444c302b070c84493a6583f2f6c59a63a3b405ec725b3630a57c

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/249135/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-03-10 12:18:06 UTC

url : hxxp://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/